TrustLynce Editorial Team, page 7
Compliance and security writers
The TrustLynce team writes about SOC 2, ISO 27001, HIPAA, GDPR and the work underneath them: scoping, evidence, controls, audits and security reviews. Guidance here is general information, not legal or audit advice.
213 articles
Compliance frameworks
How to scope your first SOC 2 report
The seven scoping decisions for a first SOC 2: services, system boundaries, categories, report type, vendors, and customer duties, agreed before the audit.
6 min read
Compliance frameworks
Moving from ISO 27001:2013 to the 2022 edition
The ISO 27001:2013 transition period is over. What changed in the clauses and Annex A, where 2013 leftovers hide in an ISMS, and how to check for them.
6 min read
Compliance frameworks
Continuous monitoring under NIST 800-53
What NIST 800-53 control CA-7 requires, how to set monitoring frequencies, which controls feed it, and how monitoring results turn into risk decisions.
5 min read
AI governance
The NIST AI Risk Management Framework, explained
What the NIST AI RMF 1.0 is, its trustworthiness characteristics, what Govern, Map, Measure, and Manage each ask for, and how it fits next to ISO/IEC 42001.
6 min read
Audit readiness
The PBC list: handling auditor requests
How to run an audit request list: triage, a tracker with the right fields, file naming, quality checks before you send, and keeping sensitive data out.
6 min read
Security engineering
Vulnerability management SLAs auditors accept
Auditors test whether you met your own remediation windows. How to set severity tiers and SLAs you can keep, handle exceptions, and evidence every finding.
6 min read
Trust and sales
Gating documents behind an NDA
How to gate a SOC 2 report and other security documents: choosing the NDA mechanism, setting approval rules, expiring access, and keeping a usable log.
6 min read
Compliance frameworks
The SOC 2 privacy criterion compared with GDPR
How the SOC 2 privacy criteria P1 to P8 line up against GDPR, where they overlap, what GDPR requires that SOC 2 never tests, and when to include privacy.
6 min read
Compliance frameworks
Building a privacy information management system on your ISMS
A step-by-step plan for extending an ISO 27001 ISMS into an ISO 27701 PIMS: roles, scope, privacy risk, controls, and the management review changes.
6 min read
Privacy
Standard contractual clauses for international transfers
How the 2021 EU standard contractual clauses work: choosing a module, completing the annexes, the clauses you cannot change, and the ongoing duties.
6 min read
Compliance frameworks
Business associate agreements: what to check before signing
What HIPAA requires every business associate agreement to contain, the clauses customers add on top, and how to test whether you can perform each.
6 min read
Compliance frameworks
How to write a Statement of Applicability
What ISO 27001 requires in a Statement of Applicability, the columns worth adding, how to justify inclusions and exclusions, and how to keep it current.
6 min read
Risk and vendors
Risk treatment options: mitigate, transfer, accept or avoid
What each of the four risk treatment options really commits you to, the evidence each leaves, why transfer never moves accountability, and when to mix.
6 min read
Compliance frameworks
Writing control implementation statements
How to write NIST 800-53 implementation statements an assessor can test: cover every part and parameter, name the mechanism, and handle inherited controls.
6 min read
Security engineering
Joiner, mover, leaver processes
Joiner, mover, leaver is one access process with three triggers. How to run each event from the HR record, why movers get missed, and what evidence to keep.
6 min read
Audit readiness
Preparing control owners for auditor interviews
Who auditors interview, the questions control owners and staff are asked, a one-page briefing for each owner, and the line between preparing and coaching.
6 min read
Compliance frameworks
DORA incident reporting
How DORA defines a major ICT-related incident, the classification criteria, the three reports owed to supervisors, and the runbook that meets each deadline.
6 min read
Compliance frameworks
HITRUST maturity scoring in the r2 assessment
How the r2 scores each requirement across policy, procedure, implemented, measured and managed, what evidence moves a score, and where effort pays off.
6 min read
Compliance frameworks
What the Govern function added in NIST CSF 2.0
Which parts of the NIST CSF 2.0 Govern function moved from version 1.1, which are new, and what each of the six Govern categories asks you to produce.
6 min read
Compliance frameworks
Reducing your PCI DSS scope
Every in-scope system must meet every applicable PCI DSS requirement. How scope works, the options that shrink it, and the ones that only look like they do.
6 min read
Compliance frameworks
SOC 2 processing integrity: who needs it and why
Which services should include processing integrity in a SOC 2, how its five criteria turn into controls on inputs, processing, and outputs, and what it costs.
6 min read
AI governance
ISO 42001 Annex A controls explained
The nine ISO/IEC 42001 Annex A control areas: what each covers, the evidence an auditor samples, which ones are new work, and how to justify an exclusion.
6 min read
Privacy
What belongs in a GDPR data processing agreement
The terms Article 28(3) makes mandatory in every DPA, what each one commits a processor to in practice, and the clauses worth negotiating beyond the minimum.
6 min read
Security engineering
Offboarding that removes access the same day
Late access removal is a classic audit exception. How to set a testable standard, start from a trigger you trust, and remove access in the right order.
6 min read